>> Welcome to Module 1,
Lesson 4, techniques and sub techniques.
In this lesson, we will define and
explore what an ATT&CK technique is.
Recognize the differences between
techniques and sub techniques.
Finally, build appreciation for how these techniques and
sub-techniques fit into the overall ATT&CK TTP model.
As you recall from our previous lesson,
ATT&CK tactics define the goals
of an adversary during a campaign or breach.
Whereas ATT&CK techniques to find the means by
which adversaries used to achieve these tactical goals.
Techniques are written from
the perspective of the adversary and
capture how an adversary
performs each action or behavior.
As you can see with example to the right,
drawn from the execution tactic,
the command and scripting
interpreter technique capture all adversaries,
maybe may abuse command and scripting
languages to execute malicious commands or payloads.
Similar to tactics,
the list of techniques very
often differs across platforms,
but this list grows and evolves over time to
keep up with variances and
innovations of adversary tradecraft.
Sub-techniques further breakdown
the details of adversary behaviors
captured in techniques for all intents and purposes.
Techniques and sub-techniques are equivalent.
The only main difference that sub-techniques
described behaviors at a lower level of detail.
As you can see with the example to the right,
are same command and scripting interpreter technique
has eight sub techniques which defined
very specific command or programming languages
that adversaries may be used to execute payloads.
Sub-techniques always have a single parent
and are not always but very often platform-specific,
such as the Windows command shell
or cmd.exe sub-technique.
Sub-techniques were explicitly designed
to help to reduce changes to techniques.
As we tried to track and capture variations and
innovations between platforms and adversary behaviors.
Techniques and sub-techniques subject are
both objects within the ATT&CK model,
each of which are assigned unique identifiers.
Technique IDs are typically referred to as TID,
as you can see with the example below with brute force.
It's TIDT1110.
Sub-technique TIDs are just extensions
of their parents TID.
As you can see with the example below with
the fourth sub-techniques of brute force.
Sub-techniques and techniques have a wealth of
additional metadata on each of
the pages that connect to the rest of ATT&CK model.
Some of those interesting metadata which we'll explore in
later lessons include mitigations,
data sources and detections, and procedure examples.
With that, we've reached
the knowledge check for this lesson.
Techniques and sub-techniques in ATT&CK are.
Please pause your video and take a second to
think about the correct answer before proceeding.
In this case, the correct answer was C,
techniques and sub-techniques in ATT&CK are
descriptions of adversary behaviors
at different levels of detail.
In summary, ATT&CK techniques
and sub-techniques represent
behaviors performed by adversaries or
how they achieve their tactical goals.
Finally, techniques and
sub-techniques are fundamentally the same.
The only difference being sub-techniques are
more specific descriptions of these behaviors.